Server Lockup

[sleepytom]

Hi Guys,

I'm working with a Windows 2003 box with exchange 2003 installed on it.

The machine is part of a fairly large domain.

This is the second time the machine has just locked up for no reason. It’s just seems to become unresponsive, no mouse I can’t ping the machine and the screen is frozen.

This server is using raid 1 for the o/s raid 1 for the logs and raid 5 for the databases.

The machine seems to lockup in the morning at around 7:00, the event logs shows this error:

"The description for Event ID ( 1000 ) in Source ( Microsoft Exchange Server ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: exsp.dll, 6.5.7638.1, 430e735b, pdfl60.dll, 6.1.0.0, 40bcc106, 0, 0000a3c5."

Has anyone come across this error before?

When I restart the machine its fine, and that stands out in the event log.

Cheers

[Tripredacus]

What changes have you made to the server lately? Using full text indexing? Update any firewall or antivirus software? Are there any dump files created?

Also can you post the error data and the event source? The Error Data is in the scroll box and looks like hex code. Make sure to use the quote box when posting. Also, the Event Source is at the top of the Event dialog, I am going to guess it is Application Error, but don't want to just presume that.

What service pack for Server 2003, which architecture? What version/SP for Exchange? Does this server handle any other roles besides exchange? On your Domain Controller using AD, what is the host OS?

The info you posted also shows a "0" which means your debug option is not set, this is an FYI and not a problem.

Did you recently install any updates to Acrobat on the server? What version of Acrobat? PDFL60.dll is part of Adobe Distiller.

Also check your RAID logs to make sure you have no integrity issues. I had experienced lock ups with my Server 2003 and it was caused by a degraded RAID5.

[cluberti]

If a server just locks up hard, and you have no mouse or keyboard at the console of the physical server, that would indicate that something even below the kernel has gone wrong and even interrupts aren't being serviced. While it's entirely possible that the OS is at fault, it's not probable. If you have a PS/2 keyboard attached to the server, you can configure it for a complete memory dump, reboot, and then try the keyboard combination to crash it the next time it occurs. However, if the server doesn't accept the keyboard commands, you may have a hardware problem.

[sleepytom]

What changes have you made to the server lately? Using full text indexing? Update any firewall or antivirus software? Are there any dump files created?

Also can you post the error data and the event source? The Error Data is in the scroll box and looks like hex code. Make sure to use the quote box when posting. Also, the Event Source is at the top of the Event dialog, I am going to guess it is Application Error, but don't want to just presume that.

What service pack for Server 2003, which architecture? What version/SP for Exchange? Does this server handle any other roles besides exchange? On your Domain Controller using AD, what is the host OS?

The info you posted also shows a "0" which means your debug option is not set, this is an FYI and not a problem.

Did you recently install any updates to Acrobat on the server? What version of Acrobat? PDFL60.dll is part of Adobe Distiller.

Also check your RAID logs to make sure you have no integrity issues. I had experienced lock ups with my Server 2003 and it was caused by a degraded RAID5.

Thanks for your reply, The only change that has been made is new anti-virus. but the was around 2 month ago. The server also uses kaspersky anti-virus for email scanning and there is a problem with that at the moment. maybe that is linked?

The code is "0000: 41 00 70 00 70 00 6c 00 A.p.p.l.

0008: 69 00 63 00 61 00 74 00 i.c.a.t.

0010: 69 00 6f 00 6e 00 20 00 i.o.n. .

0018: 46 00 61 00 69 00 6c 00 F.a.i.l.

0020: 75 00 72 00 65 00 20 00 u.r.e. .

0028: 20 00 65 00 78 00 73 00 .e.x.s.

0030: 70 00 2e 00 64 00 6c 00 p...d.l.

0038: 6c 00 20 00 36 00 2e 00 l. .6...

0040: 35 00 2e 00 37 00 36 00 5...7.6.

0048: 33 00 38 00 2e 00 31 00 3.8...1.

0050: 20 00 34 00 33 00 30 00 .4.3.0.

0058: 65 00 37 00 33 00 35 00 e.7.3.5.

0060: 62 00 20 00 69 00 6e 00 b. .i.n.

0068: 20 00 70 00 64 00 66 00 .p.d.f.

0070: 6c 00 36 00 30 00 2e 00 l.6.0...

0078: 64 00 6c 00 6c 00 20 00 d.l.l. .

0080: 36 00 2e 00 31 00 2e 00 6...1...

0088: 30 00 2e 00 30 00 20 00 0...0. .

0090: 34 00 30 00 62 00 63 00 4.0.b.c.

0098: 63 00 31 00 30 00 36 00 c.1.0.6.

00a0: 20 00 66 00 44 00 65 00 .f.D.e.

00a8: 62 00 75 00 67 00 20 00 b.u.g. .

00b0: 30 00 20 00 61 00 74 00 0. .a.t.

00b8: 20 00 6f 00 66 00 66 00 .o.f.f.

00c0: 73 00 65 00 74 00 20 00 s.e.t. .

00c8: 30 00 30 00 30 00 30 00 0.0.0.0.

00d0: 61 00 33 00 63 00 35 00 a.3.c.5.

00d8: 0d 00 0a 00 ...."

Event source is: Microsoft Exchange Server and the log is in application the server is running sp2 and sp2 for exchange.

It handles the backup role only and that is hosted by backup exec. it also does exchange features like webmail and oma.

The domain controller is also windows 2003 with sp2, No adobe updates have been applied and adobe acrobat isn’t installed.

I have checked the raid logs and there dont seem to be any errors there.

Thanks for your help

[Tripredacus]

I believe with this limited amount of info here, being a single error log, you are going to need to run some extra steps.

Firstly, you could use the Debugger if you are able to make this crash occur without the computer locking up. Otherwise, I talked to my Exchange admin, and he says any time he experiences an issue with Exchange, Microsoft has him run the Exchange Best Practices Analyzer. Make sure you read any documentation for this tool as I have no experience with it. And I cannot be used as a conduit for more information from the source at my company.

You can get this tool here:

http://www.microsoft.com/downloads/details...;displaylang=en

[AO3]

If you believe kaspersky anti-virus is caussing the problem. You could try uninstalling it. But first I would run Exchange Best Practices Analyzer.